Network security protection method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a network security protection method, electronic equipment, a storage medium and a program product. The method comprises the following steps: on the basis of obtaining any user access request under an access request time sequence, obtaining user agent data, user data and user behavior verification data according to the user access request; obtaining a comprehensive access risk coefficient by analyzing the user agent data, the user data, the user behavior verification data and analyzing associated data among the user agent data, the user data and the user behavior verification data; generating an access permission instruction or an access interception instruction according to the comprehensive access risk coefficient and an access risk coefficient threshold value; processing a user access request according to the access permission instruction or the access interception instruction; the problem of poor network security protection effectiveness caused by IP limitation-based network security protection carried out based on the scheme of the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network security protection method, electronic device, storage medium, and program product. Background Art

[0002] As the scale of Internet business expands, high-frequency data access often leads to problems such as resource runs and service anomalies.

[0003] In existing technologies, restricting abnormal high-frequency data access is often achieved by dynamically banning high-frequency IP addresses, customizing IP whitelist libraries, and identifying user identities through IP evaluation models, thereby ensuring network security.

[0004] However, network security protection based on IP restriction based on existing technology solutions can be easily bypassed by proxy pools, which leads to poor effectiveness of network security protection. Summary of the Invention

[0005] The network security protection method, electronic device, storage medium and program product provided in the embodiments of the present application are used to solve the problem of poor effectiveness of network security protection.

[0006] In a first aspect, an embodiment of the present application provides a network security protection method, comprising: obtaining any user access request under an access request sequence; obtaining user agent data, user data, and user behavior verification data according to the user access request; obtaining semantic space features and an access request string according to the user agent data; generating a target graph node according to the user data; obtaining a temporal semantic feature according to the access request sequence and the semantic space feature; obtaining a first access risk coefficient according to the temporal semantic feature; performing context association analysis on the access request string to obtain a context association feature; obtaining a temporal association feature according to the access request sequence and the context association feature; obtaining a second access risk coefficient according to the temporal association feature; and The target graph node and the preset graph structure are used to obtain graph node relationship characteristics; based on the graph node relationship characteristics, a third access risk coefficient is obtained; based on the user data and the user behavior verification data, a fourth access risk coefficient is obtained; based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, a comprehensive access risk coefficient is obtained; based on the comprehensive access risk coefficient and the access risk coefficient threshold, an access permission instruction or an access interception instruction is generated; according to the access permission instruction or the access interception instruction, the user access request is processed according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to pass processing, and the access interception instruction is used to instruct the user access request to intercept processing.

[0007] In a possible implementation, obtaining a third access risk coefficient based on the graph node relationship characteristics includes: obtaining network protocol address relationship characteristics, user device relationship characteristics, and user account relationship characteristics based on the graph node relationship characteristics; obtaining a network protocol access risk coefficient based on the network protocol address relationship characteristics; obtaining a user device access risk coefficient based on the user device relationship characteristics; obtaining a user account access risk coefficient based on the user account relationship characteristics; obtaining the third access risk coefficient based on the network protocol access risk coefficient, the user device access risk coefficient, and the user account access risk coefficient.

[0008] In a possible implementation, obtaining a fourth access risk coefficient based on the user data and the user behavior verification data includes: obtaining a preset verification trajectory and a verification trajectory fluctuation interval based on the user data; obtaining an actual request trajectory and a request trajectory fluctuation interval based on the user behavior verification data; calculating a trajectory overlap rate between the actual request trajectory and the preset verification trajectory based on the preset verification trajectory, the verification trajectory fluctuation interval, and the actual request trajectory; and obtaining the fourth access risk coefficient based on the trajectory overlap rate and the request trajectory fluctuation interval.

[0009] In a possible implementation, obtaining the fourth access risk coefficient based on the trajectory overlap rate and the requested trajectory fluctuation interval includes: determining the magnitude relationship between the trajectory overlap rate and the trajectory overlap rate threshold; if the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, determining whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtaining a first trajectory anomaly value; determining the first trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtaining a second trajectory anomaly value; determining the second trajectory anomaly value as the fourth access risk coefficient; if the trajectory overlap rate is less than the trajectory overlap rate threshold, determining whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtaining a third trajectory anomaly value; determining the third trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtaining a fourth trajectory anomaly value; determining the fourth trajectory anomaly value as the fourth access risk coefficient.

[0010] In a possible implementation, obtaining a comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient includes: judging the relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; determining the first type of weighting coefficient of the first access risk coefficient, the second type of weighting coefficient of the second access risk coefficient, the third type of weighting coefficient of the third access risk coefficient and the fourth type of weighting coefficient of the fourth access risk coefficient based on the relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; if the first access risk coefficient is greater than the access risk coefficient threshold, and / or the second access risk coefficient is greater than the access risk coefficient threshold, and / or the third access risk coefficient is greater than the access risk coefficient threshold, and / or the fourth access risk coefficient is greater than the access risk coefficient threshold, then according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient, an abnormal access risk coefficient is generated; wherein the abnormal access risk coefficient is greater than the access risk coefficient threshold; the abnormal access risk coefficient is determined as the comprehensive access risk coefficient; if the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient, a normal access risk coefficient is generated; and the normal access risk coefficient is determined as the comprehensive access risk coefficient.

[0011] In a possible implementation, after processing the user access request according to the access permission instruction, it also includes: during the user access process: obtaining user interaction behavior data and interaction timing characteristics; generating interaction behavior characteristics based on the user interaction behavior data; performing feature analysis on the interaction behavior characteristics based on the interaction timing characteristics to obtain an interaction behavior anomaly coefficient; if the interaction behavior anomaly coefficient is less than or equal to a first interaction behavior anomaly coefficient threshold, allowing the user to continue accessing; if the interaction behavior anomaly coefficient is greater than the first interaction behavior anomaly coefficient threshold and less than a second interaction behavior anomaly coefficient threshold, allowing the user to continue accessing and generating an interaction control change instruction; wherein the interaction control change instruction is used to change the layout of the interface elements of the interface accessed by the user; if the interaction behavior anomaly coefficient is greater than the second interaction behavior anomaly coefficient threshold, generating an access prohibition instruction.

[0012] In a second aspect, an embodiment of the present application provides a network security protection device, comprising:

[0013] An acquisition module, used to acquire any user access request in an access request sequence;

[0014] a processing module configured to obtain user agent data, user data, and user behavior verification data based on the user access request; obtain semantic space features and an access request string based on the user agent data; generate a target graph node based on the user data; obtain a temporal semantic feature based on the access request timing and the semantic space feature; obtain a first access risk coefficient based on the temporal semantic feature; perform context association analysis on the access request string to obtain a context association feature; obtain a temporal association feature based on the access request timing and the context association feature; obtain a second access risk coefficient based on the temporal association feature; obtain a graph node relationship feature based on the target graph node and a preset graph structure; obtain a third access risk coefficient based on the graph node relationship feature; obtain a fourth access risk coefficient based on the user data and the user behavior verification data; obtain a comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient; and generate an access permission instruction or an access interception instruction based on the comprehensive access risk coefficient and an access risk coefficient threshold;

[0015] An execution module is used to process the user access request according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to be processed through, and the access interception instruction is used to instruct the user access request to be intercepted.

[0016] In a possible implementation, when the processing module obtains the third access risk coefficient based on the graph node relationship characteristics, it is specifically used to: obtain network protocol address relationship characteristics, user device relationship characteristics and user account relationship characteristics based on the graph node relationship characteristics; obtain the network protocol access risk coefficient based on the network protocol address relationship characteristics; obtain the user device access risk coefficient based on the user device relationship characteristics; obtain the user account access risk coefficient based on the user account relationship characteristics; obtain the third access risk coefficient based on the network protocol access risk coefficient, the user device access risk coefficient and the user account access risk coefficient.

[0017] In a possible implementation, when the processing module obtains the fourth access risk coefficient based on the user data and the user behavior verification data, it is specifically used to: obtain a preset verification trajectory and a verification trajectory fluctuation interval based on the user data; obtain an actual request trajectory and a request trajectory fluctuation interval based on the user behavior verification data; calculate the trajectory overlap rate between the actual request trajectory and the preset verification trajectory based on the preset verification trajectory, the verification trajectory fluctuation interval and the actual request trajectory; and obtain the fourth access risk coefficient based on the trajectory overlap rate and the request trajectory fluctuation interval.

[0018] In a possible embodiment, when the processing module obtains the fourth access risk coefficient based on the trajectory overlap rate and the requested trajectory fluctuation interval, it is specifically used to: determine the size relationship between the trajectory overlap rate and the trajectory overlap rate threshold; if the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, determine whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtain a first trajectory anomaly value; determine the first trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtain a second trajectory anomaly value; determine the second trajectory anomaly value as the fourth access risk coefficient; if the trajectory overlap rate is less than the trajectory overlap rate threshold, determine whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtain a third trajectory anomaly value; determine the third trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtain a fourth trajectory anomaly value; determine the fourth trajectory anomaly value as the fourth access risk coefficient.

[0019] In a possible implementation manner, when the processing module obtains the comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, it is specifically used to: judge the size relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; determine the first type of weighting coefficient of the first access risk coefficient, the second type of weighting coefficient of the second access risk coefficient, the third type of weighting coefficient of the third access risk coefficient, and the fourth type of weighting coefficient of the fourth access risk coefficient based on the size relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; if the first access risk coefficient is greater than the access risk coefficient threshold, and / or the second access risk coefficient is greater than the access risk coefficient threshold, and / or the third access risk coefficient is greater than the access risk coefficient threshold, and / or the fourth access risk coefficient is greater than the access risk coefficient threshold, then an abnormal access risk coefficient is generated according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient; wherein the abnormal access risk coefficient is greater than the access risk coefficient threshold; the abnormal access risk coefficient is determined as the comprehensive access risk coefficient; if the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then a normal access risk coefficient is generated according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient; the normal access risk coefficient is determined as the comprehensive access risk coefficient.

[0020] In a possible implementation, after processing the user access request according to the access permission instruction, the network security protection device is further used to: during the user access process: obtain user interaction behavior data and interaction timing characteristics; generate interaction behavior characteristics based on the user interaction behavior data; perform feature analysis on the interaction behavior characteristics based on the interaction timing characteristics to obtain an interaction behavior anomaly coefficient; if the interaction behavior anomaly coefficient is less than or equal to a first interaction behavior anomaly coefficient threshold, allow the user to continue access; if the interaction behavior anomaly coefficient is greater than the first interaction behavior anomaly coefficient threshold and less than a second interaction behavior anomaly coefficient threshold, allow the user to continue access and generate an interaction control change instruction; wherein the interaction control change instruction is used to change the layout of interface elements of the interface accessed by the user; if the interaction behavior anomaly coefficient is greater than the second interaction behavior anomaly coefficient threshold, generate an access prohibition instruction.

[0021] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor;

[0022] The memory stores computer-executable instructions;

[0023] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0024] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0025] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0026] The network security protection method, electronic device, storage medium and program product provided by the embodiments of the present application obtain any user access request under the access request sequence, obtain user agent data, user data, and user behavior verification data according to the user access request; obtain semantic space features and access request character string according to the user agent data; generate target graph nodes according to the user data; obtain temporal semantic features according to the access request sequence and semantic space features; obtain a first access risk coefficient according to the temporal semantic features; perform context association analysis on the access request character string to obtain context association features; obtain temporal association features according to the access request sequence and context association features; obtain temporal association features according to the temporal association features To the second access risk coefficient; according to the target graph node and the preset graph structure, the graph node relationship characteristics are obtained; according to the graph node relationship characteristics, the third access risk coefficient is obtained; according to the user data and the user behavior verification data, the fourth access risk coefficient is obtained; according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, a comprehensive access risk coefficient is obtained; according to the comprehensive access risk coefficient and the access risk coefficient threshold, an access permission instruction or an access interception instruction is generated; the user access request is processed according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to pass through, and the access interception instruction is used to instruct the user access request to intercept. By analyzing the user agent data, user data, user behavior verification data and the associated data among the user agent data, user data and user behavior verification data, a comprehensive access risk coefficient is obtained; according to the comprehensive access risk coefficient and the access risk coefficient threshold, an access permission instruction or an access interception instruction is generated; the user access request is processed according to the access permission instruction or the access interception instruction; the problem of poor effectiveness of network security protection caused by network security protection based on IP restriction based on the solution of the prior art is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0028] Figure 1 A flowchart of a network security protection method provided in one embodiment of the present application;

[0029] Figure 2 A schematic diagram of the structure of a network security protection device provided in one embodiment of the present application;

[0030] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application.

[0031] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0033] In the technical solution of this application, the user personal information involved and the collection, storage, use, processing, transmission, provision and disclosure of data are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] As internet services expand, high-frequency data access often leads to resource runs, service anomalies, and other issues. Existing technologies often limit abnormal high-frequency data access and ensure network security by dynamically blocking high-frequency IP addresses, creating custom IP whitelists, and identifying users through IP assessment models. However, network security protection based on IP restrictions implemented in existing solutions can be easily bypassed by proxy pools, resulting in poor network security protection effectiveness.

[0036] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 1 A flowchart of a network security protection method provided in one embodiment of the present application is shown as follows: Figure 1As shown, the execution subject of the network security protection method provided in this embodiment can be any form of electronic device. For example, this embodiment uses a server as the execution subject of the method of this embodiment. The network security protection method provided in this embodiment includes the following steps:

[0038] Step S101: obtaining any user access request in an access request sequence.

[0039] Step S102: obtaining user agent data, user data, and user behavior verification data according to the user access request.

[0040] Exemplarily, the server can obtain user agent data, user data, and user behavior verification data by parsing the obtained user access request; among them, the user agent data, that is, the User-Agent string, is part of the HTTP request header, which is used to identify the type, version, operating system and other information of the user client (such as a browser, crawler program, etc.) accessing the network; user data includes the user network address, user device and user account; user behavior verification data is used to indicate the user's behavior verification operation when accessing the network, such as entering a verification code in an image and controlling the movement trajectory of the mouse.

[0041] Step S103: Obtain semantic space features and access request character strings according to the user agent data.

[0042] Exemplarily, user agent data is input into a pre-trained large language model, so that the pre-trained large language model parses the user agent data based on preset text prompts to output semantic space features and an access request string. Specifically, for example, the pre-trained large language model performs semantic space vectorization processing on the user agent data based on the preset text prompts, thereby obtaining a semantic feature vector, i.e., a semantic space feature; and the pre-trained large language model performs string extraction on the user agent data based on the preset text prompts, thereby obtaining an access request string.

[0043] Step S104: Generate target graph nodes according to user data.

[0044] Exemplarily, the user data includes the user network address, user device and user account; furthermore, based on the user network address, user device and user account, a target graph node is constructed so that in step S110, the association relationship between the target graph node and other graph nodes is determined based on the user network address, user device and user account.

[0045] Step S105 : obtaining a temporal semantic feature according to the access request temporal and semantic space features.

[0046] For example, based on the access request time series, the semantic space features are sampled to time scales such as seconds, minutes, hours, days, and weeks, and then time series analysis is performed on them to capture short-term fluctuations and long-term trends. Specifically, for example, the semantic space features are used as static features, the corresponding abnormal device type is used as the basic malicious identifier, and the access request time series is used as a dynamic feature. At the corresponding time scale, the semantic space features are analyzed to determine the access frequency, that is, the frequency of occurrence of the basic malicious identifier, and thus the time series semantic features are obtained.

[0047] Step S106: Obtain a first access risk coefficient based on the temporal semantic feature.

[0048] For example, by quantifying the temporal semantic features, a first access risk coefficient can be obtained. Specifically, for example, a mapping relationship table between the frequency range of access frequency and the first access risk coefficient is shown in Table 1. Furthermore, based on the temporal semantic features, the access frequency is determined to be 21, and based on the mapping relationship shown in Table 1, the first access risk coefficient is obtained to be 0.5.

[0049] Table 1

[0050]

[0051] Step S107: Perform context association analysis on the access request character string to obtain context association features.

[0052] For example, the access request string is python-requests / 2.28.2. A context association analysis is performed based on the access request string "python-requests / 2.28.2". The context role of the access request string "python-requests / 2.28.2" is determined through the syntax tree and attention weight. For example, when python-requests appears at the beginning of the string, its purpose may be an actively declared client type. When python-requests and curl / 7.68.0 co-occur, its purpose may be for debugging or a mixed tool chain. Then, based on the context role determined by the above analysis, a context association feature is obtained.

[0053] Step S108 : obtaining a timing correlation feature according to the access request timing and the context correlation feature.

[0054] For example, the access request time series is downsampled to time scales such as seconds, minutes, hours, days, and weeks, and then time series analysis is performed on the semantic space features to capture short-term fluctuations and long-term trends. Specifically, for example, based on the time interval corresponding to the access request time series, the feature similarity between the context-related features and the context-related features of other user access requests is calculated. Based on the relationship between each feature similarity and a feature similarity threshold, the number of feature similarities exceeding the feature similarity threshold is determined, thus obtaining the time series correlation features.

[0055] Step S109: obtaining a second access risk coefficient according to the time series correlation feature.

[0056] For example, the second access risk coefficient is obtained based on the number of feature similarities corresponding to the time series correlation features that are greater than the feature similarity threshold. Specifically, for example, a mapping relationship table between the number of feature similarities greater than the feature similarity threshold and the second access risk coefficient is shown in Table 2. Furthermore, according to the mapping relationship shown in Table 2, if the number of feature similarities is 11, the second access risk coefficient is 0.3.

[0057] Table 2

[0058]

[0059] Step S110: Obtain graph node relationship features based on the target graph node and the preset graph structure.

[0060] Exemplarily, based on step S104, it can be known that the target graph node is determined by the user network address, user device, and user account, and the association relationship between the target graph node and other graph nodes in the preset graph structure is determined based on the user network address, user device, and user account, thereby obtaining the graph node relationship characteristics. Specifically, for example, by determining the association relationship between the target graph node and other graph nodes in the preset graph structure based on the user network address, user device, and user account, it can be determined whether there are multiple user accounts sharing the same user network address, whether there are multiple user accounts sharing the same user device, whether there is a user network address used by multiple user devices, and whether there is a user device that frequently changes to different user network addresses; according to the above-mentioned association relationship determination process, the graph node relationship characteristics are obtained.

[0061] Step S111: Obtain a third access risk coefficient based on the graph node relationship characteristics.

[0062] Exemplarily, based on the graph node relationship characteristics obtained, the risks of graph nodes having a correlation with the target graph node are analyzed according to the graph node relationship characteristics to obtain a third access risk coefficient. Specifically, for example, the target graph node includes user network address add_1, user device devi_1, and user account accou_1. Based on the graph node relationship characteristics, it can be known that user device devi_1 has been logged in by user account accou_2, and user account accou_2 is associated with user network address add_3, which is a malicious attack network address. Based on the above graph node relationship characteristics, the third access risk coefficient can be obtained.

[0063] In another possible implementation, the specific implementation steps of step S111 include:

[0064] Step S1111 , obtaining network protocol address relationship characteristics, user device relationship characteristics, and user account relationship characteristics based on the graph node relationship characteristics.

[0065] Step S1112: Obtain a network protocol access risk coefficient based on the network protocol address relationship characteristics.

[0066] Exemplarily, based on the network protocol address relationship characteristics, determine whether the malicious attack user device and / or malicious attack user account has used the user network address corresponding to the target graph node; and then determine the corresponding network protocol access risk coefficient based on the usage.

[0067] Step S1113: Obtain the user device access risk coefficient based on the user device relationship characteristics.

[0068] Exemplarily, based on the user-device relationship characteristics, for the user device, determine whether one or more logged-in user accounts are malicious attack user accounts and whether one or more connected user network addresses are malicious attack user network addresses; and then obtain the user device access risk coefficient based on the above-mentioned logged-in user accounts and connected user network addresses. Specifically, for example, if one or more logged-in user accounts are malicious attack user accounts and one or more connected user network addresses are malicious attack user network addresses, the user device access risk coefficient is 0.8; if one or more logged-in user accounts are malicious attack user accounts and one or more connected user network addresses are not malicious attack user network addresses, the user device access risk coefficient is 0.3; if one or more logged-in user accounts are not malicious attack user accounts and one or more connected user network addresses are not malicious attack user network addresses, the user device access risk coefficient is 0.

[0069] Step S1114: Obtain the user account access risk coefficient based on the user account relationship characteristics.

[0070] Exemplarily, based on the user account relationship characteristics, for the user account, determine whether one or more user devices that have been logged in are malicious attack user devices, and whether one or more user network addresses that have been connected are malicious attack user network addresses; and then, based on the above-mentioned user devices that have been logged in and user network addresses that have been connected, obtain the user account access risk coefficient.

[0071] Step S1115 , obtaining a third access risk coefficient according to the network protocol access risk coefficient, the user device access risk coefficient, and the user account access risk coefficient.

[0072] For example, the network protocol access risk coefficient, the user device access risk coefficient, and the user account access risk coefficient are weighted to obtain a third access risk coefficient; wherein the weighted calculation formula is shown in formula (1),

[0073] (1)

[0074] in, is the third access risk factor; The risk factor for network protocol access; is the weighted coefficient of the network protocol access risk factor; Access risk factor for user devices; A weighted coefficient for user device access risk; The risk factor for user account access; The weighted coefficient of the user account access risk factor.

[0075] Step S112: Obtain a fourth access risk coefficient based on the user data and the user behavior verification data.

[0076] Specifically, the specific implementation steps of step S112 include:

[0077] Step S1121: Obtain a preset verification trajectory and a verification trajectory fluctuation interval based on user data.

[0078] For example, the user's age is determined based on the user data, and then a corresponding preset verification trajectory and verification trajectory fluctuation interval are generated based on the user's age. Specifically, for example, if the user is between 10 and 50 years old, they have strong hand control and low jitter when moving the mouse, so a complex preset verification trajectory and a verification trajectory fluctuation interval within the first interval can be generated. If the user is over 50 years old, they have poor hand control and high jitter when moving the mouse, so a simple preset verification trajectory and a verification trajectory fluctuation interval within the second interval can be generated; wherein the first interval is smaller than the second interval.

[0079] Step S1122: According to the user behavior verification data, the actual request trajectory and the request trajectory fluctuation range are obtained.

[0080] For example, by parsing the user behavior verification data, the actual request trajectory generated by the user moving the mouse based on the preset verification trajectory and the corresponding request trajectory fluctuation range can be obtained.

[0081] Step S1123 : Calculate the trajectory overlap rate between the actual requested trajectory and the preset verification trajectory according to the preset verification trajectory, the verification trajectory fluctuation interval, and the actual requested trajectory.

[0082] Exemplarily, based on the preset verification trajectory and the verification trajectory fluctuation interval, the trajectory range of the preset verification trajectory is obtained, and then the trajectory length L1 of the actual requested trajectory that falls within the trajectory range of the preset verification trajectory is determined. The ratio of the trajectory length L1 to the total length L0 of the actual requested trajectory is calculated, that is, the trajectory overlap rate between the actual requested trajectory and the preset verification trajectory is obtained.

[0083] Step S1124 : Obtain a fourth access risk coefficient according to the trajectory overlap rate and the requested trajectory fluctuation interval.

[0084] Specifically, the specific implementation steps of step S1124 include:

[0085] Step S1124a, determining the relationship between the trajectory overlap rate and the trajectory overlap rate threshold.

[0086] Step S1124b: If the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, it is determined whether the requested trajectory fluctuation interval is 0.

[0087] Step S1124c: If the requested trajectory fluctuation interval is 0, a first trajectory abnormal value is obtained.

[0088] For example, if the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, it indicates that the trajectory verification meets the preset requirements; further, if the requested trajectory fluctuation interval is 0, it indicates that the user controlling the mouse movement is actually an automated script, and the first trajectory anomaly value is obtained, for example, the first trajectory anomaly value is 0.7.

[0089] Step S1124d: Determine the first trajectory abnormal value as the fourth access risk coefficient.

[0090] Step S1124e: If the requested trajectory fluctuation interval is not 0, a second trajectory abnormal value is obtained.

[0091] For example, if the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, it indicates that the trajectory verification meets the preset requirements; further, if the requested trajectory fluctuation interval is not 0, it indicates that the user controlling the mouse movement is a real person, and the second trajectory anomaly value is obtained, for example, the second trajectory anomaly value is 0.2.

[0092] Step S1124f: Determine the second trajectory abnormal value as the fourth access risk coefficient.

[0093] Step S1124g: If the trajectory overlap rate is less than the trajectory overlap rate threshold, determine whether the requested trajectory fluctuation interval is 0.

[0094] Step S1124h: If the requested trajectory fluctuation interval is 0, a third trajectory abnormal value is obtained.

[0095] For example, if the trajectory overlap rate is less than the trajectory overlap rate threshold, it indicates that the trajectory verification does not meet the preset requirements; on this basis, if the requested trajectory fluctuation interval is 0, it indicates that the user controlling the mouse movement is actually an automated script, and then a third trajectory anomaly value is obtained, for example, the third trajectory anomaly value is 1.

[0096] Step S1124i: Determine the third trajectory outlier as the fourth access risk coefficient.

[0097] Step S1124j: If the requested trajectory fluctuation interval is not 0, a fourth trajectory abnormal value is obtained.

[0098] For example, if the trajectory overlap rate is less than the trajectory overlap rate threshold, it indicates that the trajectory verification does not meet the preset requirements; on this basis, if the requested trajectory fluctuation interval is not 0, it indicates that the user controlling the mouse movement is a real person, and then a fourth trajectory anomaly value is obtained, for example, the fourth trajectory anomaly value is 0.5.

[0099] Step S1124k: Determine the fourth trajectory outlier as the fourth access risk coefficient.

[0100] Step S113 , obtaining a comprehensive access risk coefficient according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient.

[0101] Illustratively, a comprehensive access risk coefficient may be obtained by performing weighted calculation on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient.

[0102] In a possible implementation, the specific steps of implementing step S113 include:

[0103] Step S1131 , determining the relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient and the access risk coefficient threshold.

[0104] Step S1132: Determine the first type of weighting coefficient of the first access risk coefficient, the second type of weighting coefficient of the second access risk coefficient, the third type of weighting coefficient of the third access risk coefficient, and the fourth type of weighting coefficient of the fourth access risk coefficient based on the relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient and the access risk coefficient threshold.

[0105] Exemplarily, if the first access risk coefficient is greater than the access risk coefficient threshold, a first weighting coefficient is obtained; if the first access risk coefficient is less than or equal to the access risk coefficient threshold, a second weighting coefficient is obtained; based on the first weighting coefficient and the second weighting coefficient, a first type of weighting coefficient of the first access risk coefficient is determined.

[0106] If the second access risk coefficient is greater than the access risk coefficient threshold, a third weighting coefficient is obtained; if the second access risk coefficient is less than or equal to the access risk coefficient threshold, a fourth weighting coefficient is obtained; based on the third weighting coefficient and the fourth weighting coefficient, the second type of weighting coefficient of the second access risk coefficient is determined.

[0107] If the third access risk coefficient is greater than the access risk coefficient threshold, the fifth weighted coefficient is obtained; if the third access risk coefficient is less than or equal to the access risk coefficient threshold, the sixth weighted coefficient is obtained; based on the fifth weighted coefficient and the sixth weighted coefficient, the third type of weighted coefficient of the third access risk coefficient is determined.

[0108] If the fourth access risk coefficient is greater than the access risk coefficient threshold, the seventh weighted coefficient is obtained; if the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, the eighth weighted coefficient is obtained; based on the seventh weighted coefficient and the eighth weighted coefficient, the fourth type of weighted coefficient of the fourth access risk coefficient is determined.

[0109] Step S1133, if the first access risk coefficient is greater than the access risk coefficient threshold, and / or the second access risk coefficient is greater than the access risk coefficient threshold, and / or the third access risk coefficient is greater than the access risk coefficient threshold, and / or the fourth access risk coefficient is greater than the access risk coefficient threshold, then based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first category weighting coefficient, the second category weighting coefficient, the third category weighting coefficient, and the fourth category weighting coefficient, an abnormal access risk coefficient is generated; wherein the abnormal access risk coefficient is greater than the access risk coefficient threshold.

[0110] Exemplarily, if the first access risk coefficient is greater than the access risk coefficient threshold, the second access risk coefficient is less than or equal to the access risk coefficient threshold, the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then a weighted calculation is performed based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first weighting coefficient, the fourth weighting coefficient, the sixth weighting coefficient, and the eighth weighting coefficient to obtain the abnormal access risk coefficient.

[0111] Step S1134: determine the abnormal access risk coefficient as the comprehensive access risk coefficient.

[0112] Step S1135, if the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then a normal access risk coefficient is generated based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first category weighting coefficient, the second category weighting coefficient, the third category weighting coefficient, and the fourth category weighting coefficient.

[0113] Exemplarily, if the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then a weighted calculation is performed based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the second weighting coefficient, the fourth weighting coefficient, the sixth weighting coefficient, and the eighth weighting coefficient to obtain a normal access risk coefficient.

[0114] Step S1136: Determine the normal access risk coefficient as the comprehensive access risk coefficient.

[0115] In the steps of this embodiment, the weighting coefficients in the subsequent steps are determined by subdividing the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, and their size relationship with the access risk coefficient threshold; further, if there are one or more situations that are greater than the access risk coefficient threshold, the abnormal access risk coefficient is calculated based on the corresponding weighting coefficient, and the abnormal access risk coefficient is determined as the comprehensive access risk coefficient, so that the subsequent steps can generate access interception instructions, thereby ensuring network security.

[0116] Step S114: Generate an access permission instruction or an access interception instruction based on the comprehensive access risk coefficient and the access risk coefficient threshold.

[0117] Exemplarily, if the comprehensive access risk coefficient is greater than the access risk coefficient threshold, an access interception instruction is generated; if the comprehensive access risk coefficient is less than or equal to the access risk coefficient threshold, an access permission instruction is generated.

[0118] Step S115: Process the user access request according to the access permission instruction or the access interception instruction.

[0119] Specifically, the access permission instruction is used to instruct that a user access request be processed through, and the access interception instruction is used to instruct that a user access request be processed intercept.

[0120] In this embodiment, based on obtaining any user access request under the access request sequence, user agent data, user data, and user behavior verification data are obtained according to the user access request; semantic space features and access request character strings are obtained according to the user agent data; target graph nodes are generated according to the user data; temporal semantic features are obtained according to the access request sequence and semantic space features; a first access risk coefficient is obtained according to the temporal semantic features; a context association analysis is performed on the access request character strings to obtain context association features; a temporal association feature is obtained according to the access request sequence and context association features; a second access risk coefficient is obtained according to the temporal association features; and a target node is generated according to the target node. The graph nodes and the preset graph structure are used to obtain the graph node relationship characteristics; based on the graph node relationship characteristics, a third access risk coefficient is obtained; based on the user data and user behavior verification data, a fourth access risk coefficient is obtained; based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, a comprehensive access risk coefficient is obtained; based on the comprehensive access risk coefficient and the access risk coefficient threshold, an access permission instruction or an access interception instruction is generated; and the user access request is processed according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to pass through, and the access interception instruction is used to instruct the user access request to intercept. By analyzing the user agent data, user data, user behavior verification data and the associated data among the user agent data, user data and user behavior verification data, a comprehensive access risk coefficient is obtained; based on the comprehensive access risk coefficient and the access risk coefficient threshold, an access permission instruction or an access interception instruction is generated; and the user access request is processed according to the access permission instruction or the access interception instruction. This solves the problem of poor network security protection effectiveness caused by network security protection based on IP restrictions based on the existing technology.

[0121] Furthermore, after processing the user access request according to the access permission instruction, the method provided in the embodiment of the present application further includes:

[0122] S200, during user access:

[0123] Step S201: Acquire user interaction behavior data and interaction time series features.

[0124] Step S202: Generate interaction behavior features based on user interaction behavior data.

[0125] Step S203 , performing feature analysis on the interaction behavior features according to the interaction time sequence features to obtain an interaction behavior abnormality coefficient.

[0126] For example, the interactive behavior feature is downloading a file from a storage area. The interactive behavior feature is analyzed based on the interactive timing feature to determine the frequency of the download behavior, and then the corresponding interactive behavior abnormality coefficient is determined based on the frequency of the download behavior.

[0127] Step S204: If the interaction behavior abnormality coefficient is less than or equal to the first interaction behavior abnormality coefficient threshold, the user is allowed to continue accessing.

[0128] Step S205: If the interaction behavior abnormality coefficient is greater than the first interaction behavior abnormality coefficient threshold and less than the second interaction behavior abnormality coefficient threshold, the user is allowed to continue accessing and an interaction control change instruction is generated; wherein the interaction control change instruction is used to change the layout of the interface elements of the interface accessed by the user.

[0129] Exemplarily, if the interaction behavior abnormality coefficient is greater than the first interaction behavior abnormality coefficient threshold and less than the second interaction behavior abnormality coefficient threshold, while allowing the user to continue accessing, an interaction control change instruction is generated to change the layout of the interface elements of the interface accessed by the user based on the interaction control change instruction, such as changing the position, size or display mode of the "Download" interaction control (from Chinese to English, simplified Chinese to traditional Chinese) to avoid automated scripts repeatedly executing download operations, thereby improving network security.

[0130] Step S206: If the interaction behavior abnormality coefficient is greater than the second interaction behavior abnormality coefficient threshold, a prohibit access instruction is generated.

[0131] For example, based on the generated access prohibition instruction, it can be achieved that users accessing the network cannot access the network within a preset time; wherein the preset time is determined based on the access prohibition instruction.

[0132] Figure 2 A schematic diagram of the structure of a network security protection device provided in one embodiment of the present application is shown as follows: Figure 2 As shown, the network security protection device 3 provided in this embodiment includes:

[0133] An acquisition module 31 is configured to acquire any user access request in an access request sequence;

[0134] Processing module 32 is configured to obtain user agent data, user data, and user behavior verification data based on a user access request; obtain semantic space features and an access request string based on the user agent data; generate a target graph node based on the user data; obtain a temporal semantic feature based on the access request timing and semantic space features; obtain a first access risk coefficient based on the temporal semantic feature; perform context association analysis on the access request string to obtain a context association feature; obtain a temporal association feature based on the access request timing and context association features; obtain a second access risk coefficient based on the temporal association feature; obtain a graph node relationship feature based on the target graph node and a preset graph structure; obtain a third access risk coefficient based on the graph node relationship feature; obtain a fourth access risk coefficient based on the user data and user behavior verification data; obtain a comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient; and generate an access permission instruction or an access interception instruction based on the comprehensive access risk coefficient and the access risk coefficient threshold.

[0135] The execution module 33 is used to process the user access request according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to be processed, and the access interception instruction is used to instruct the user access request to be intercepted.

[0136] In a possible implementation, when the processing module 32 obtains the third access risk coefficient based on the graph node relationship characteristics, it is specifically used to: obtain the network protocol address relationship characteristics, the user device relationship characteristics and the user account relationship characteristics based on the graph node relationship characteristics; obtain the network protocol access risk coefficient based on the network protocol address relationship characteristics; obtain the user device access risk coefficient based on the user device relationship characteristics; obtain the user account access risk coefficient based on the user account relationship characteristics; obtain the third access risk coefficient based on the network protocol access risk coefficient, the user device access risk coefficient and the user account access risk coefficient.

[0137] In one possible implementation, when the processing module 32 obtains the fourth access risk coefficient based on the user data and the user behavior verification data, it is specifically used to: obtain a preset verification trajectory and a verification trajectory fluctuation interval based on the user data; obtain an actual request trajectory and a request trajectory fluctuation interval based on the user behavior verification data; calculate the trajectory overlap rate between the actual request trajectory and the preset verification trajectory based on the preset verification trajectory, the verification trajectory fluctuation interval and the actual request trajectory; and obtain the fourth access risk coefficient based on the trajectory overlap rate and the request trajectory fluctuation interval.

[0138] In one possible embodiment, when the processing module 32 obtains the fourth access risk coefficient based on the trajectory overlap rate and the requested trajectory fluctuation interval, it is specifically used to: determine the size relationship between the trajectory overlap rate and the trajectory overlap rate threshold; if the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, determine whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtain a first trajectory anomaly value; determine the first trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtain a second trajectory anomaly value; determine the second trajectory anomaly value as the fourth access risk coefficient; if the trajectory overlap rate is less than the trajectory overlap rate threshold, determine whether the requested trajectory fluctuation interval is 0; if the requested trajectory fluctuation interval is 0, obtain a third trajectory anomaly value; determine the third trajectory anomaly value as the fourth access risk coefficient; if the requested trajectory fluctuation interval is not 0, obtain a fourth trajectory anomaly value; determine the fourth trajectory anomaly value as the fourth access risk coefficient.

[0139] In a possible implementation, when the processing module 32 obtains the comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient, it is specifically used to: determine the size relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; determine the first type of weighting coefficient of the first access risk coefficient, the second type of weighting coefficient of the second access risk coefficient, the third type of weighting coefficient of the third access risk coefficient, and the fourth type of weighting coefficient of the fourth access risk coefficient based on the size relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient and the fourth access risk coefficient and the access risk coefficient threshold; if the first access risk coefficient is greater than the access risk coefficient threshold, and / or the second access risk coefficient is greater than the access risk coefficient threshold, and / or the third access risk coefficient is greater than the access risk coefficient threshold, and / or the fourth access risk coefficient is greater than access risk coefficient threshold, then according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient, an abnormal access risk coefficient is generated; wherein the abnormal access risk coefficient is greater than the access risk coefficient threshold; the abnormal access risk coefficient is determined as the comprehensive access risk coefficient; if the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighted coefficient, the second type of weighted coefficient, the third type of weighted coefficient, and the fourth type of weighted coefficient, a normal access risk coefficient is generated; the normal access risk coefficient is determined as the comprehensive access risk coefficient.

[0140] In one possible implementation, after processing the user access request according to the access permission instruction, the network security protection device 3 is further used to: during the user access process: obtain user interaction behavior data and interaction timing characteristics; generate interaction behavior characteristics based on the user interaction behavior data; perform feature analysis on the interaction behavior characteristics based on the interaction timing characteristics to obtain an interaction behavior anomaly coefficient; if the interaction behavior anomaly coefficient is less than or equal to a first interaction behavior anomaly coefficient threshold, the user is allowed to continue accessing; if the interaction behavior anomaly coefficient is greater than the first interaction behavior anomaly coefficient threshold and less than the second interaction behavior anomaly coefficient threshold, the user is allowed to continue accessing and an interaction control change instruction is generated; wherein the interaction control change instruction is used to change the layout of the interface elements of the interface accessed by the user; if the interaction behavior anomaly coefficient is greater than the second interaction behavior anomaly coefficient threshold, an access prohibition instruction is generated.

[0141] The acquisition module 31, the processing module 32 and the execution module 33 are connected in sequence. The network security protection device 3 provided in this embodiment can execute the following steps: Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0142] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 3 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0143] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that the at least one processor 501 performs the above method.

[0144] The specific implementation process of the processor 501 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0145] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0146] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0147] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0148] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0149] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0150] The readable storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0151] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0152] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0153] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0154] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0155] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0156] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0157] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A network security protection method, characterized in that: include: Get any user access request in the access request sequence; Obtaining user agent data, user data, and user behavior verification data according to the user access request; Obtaining semantic space features and access request character strings according to the user agent data; Generate a target graph node according to the user data; Obtaining a time sequence semantic feature according to the access request time sequence and the semantic space feature; Obtaining a first access risk coefficient according to the temporal semantic feature; Performing context association analysis on the access request character string to obtain context association features; Obtaining a timing correlation feature according to the access request timing and the context correlation feature; Obtaining a second access risk coefficient according to the time series correlation feature; Obtaining graph node relationship features according to the target graph node and the preset graph structure; Obtaining a third access risk coefficient according to the graph node relationship characteristics; Obtaining a fourth access risk coefficient based on the user data and the user behavior verification data; Obtaining a comprehensive access risk coefficient according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient; Generate an access permission instruction or an access blocking instruction according to the comprehensive access risk coefficient and the access risk coefficient threshold; The user access request is processed according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to be processed through, and the access interception instruction is used to instruct the user access request to be processed interception.

2. The method according to claim 1, characterized in that Obtaining a third access risk coefficient according to the graph node relationship characteristics includes: According to the graph node relationship characteristics, network protocol address relationship characteristics, user device relationship characteristics and user account relationship characteristics are obtained; Obtaining a network protocol access risk coefficient based on the network protocol address relationship characteristics; Obtaining a user device access risk coefficient based on the user device relationship characteristics; Obtaining a user account access risk coefficient based on the user account relationship characteristics; The third access risk coefficient is obtained according to the network protocol access risk coefficient, the user device access risk coefficient, and the user account access risk coefficient.

3. The method according to claim 1, characterized in that Obtaining a fourth access risk coefficient based on the user data and the user behavior verification data includes: According to the user data, a preset verification trajectory and a verification trajectory fluctuation range are obtained; According to the user behavior verification data, an actual request trajectory and a request trajectory fluctuation range are obtained; Calculating a trajectory overlap rate between the actual requested trajectory and the preset verification trajectory based on the preset verification trajectory, the verification trajectory fluctuation interval, and the actual requested trajectory; The fourth access risk coefficient is obtained according to the trajectory overlap rate and the requested trajectory fluctuation interval.

4. The method according to claim 3, characterized in that Obtaining the fourth access risk coefficient according to the trajectory overlap rate and the requested trajectory fluctuation interval includes: Determining a relationship between the trajectory overlap rate and a trajectory overlap rate threshold; If the trajectory overlap rate is greater than or equal to the trajectory overlap rate threshold, determining whether the requested trajectory fluctuation interval is 0; If the requested trajectory fluctuation interval is 0, a first trajectory abnormal value is obtained; determining the first trajectory abnormal value as the fourth access risk coefficient; If the requested trajectory fluctuation interval is not 0, a second trajectory abnormal value is obtained; determining the second trajectory abnormal value as the fourth access risk coefficient; If the trajectory overlap rate is less than the trajectory overlap rate threshold, determining whether the requested trajectory fluctuation interval is 0; If the requested trajectory fluctuation interval is 0, a third trajectory abnormal value is obtained; determining the third trajectory abnormal value as the fourth access risk coefficient; If the requested trajectory fluctuation interval is not 0, a fourth trajectory abnormal value is obtained; The fourth trajectory abnormal value is determined as the fourth access risk coefficient.

5. The method according to any one of claims 1 to 4, characterized in that Obtaining a comprehensive access risk coefficient according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient includes: Determine a magnitude relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient and the access risk coefficient threshold; Determining, based on a relationship between the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient and the access risk coefficient threshold, a first type of weighting coefficient for the first access risk coefficient, a second type of weighting coefficient for the second access risk coefficient, a third type of weighting coefficient for the third access risk coefficient, and a fourth type of weighting coefficient for the fourth access risk coefficient; If the first access risk coefficient is greater than the access risk coefficient threshold, and / or the second access risk coefficient is greater than the access risk coefficient threshold, and / or the third access risk coefficient is greater than the access risk coefficient threshold, and / or the fourth access risk coefficient is greater than the access risk coefficient threshold, then an abnormal access risk coefficient is generated according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighting coefficient, the second type of weighting coefficient, the third type of weighting coefficient, and the fourth type of weighting coefficient; wherein the abnormal access risk coefficient is greater than the access risk coefficient threshold; Determining the abnormal access risk coefficient as the comprehensive access risk coefficient; If the first access risk coefficient is less than or equal to the access risk coefficient threshold, and the second access risk coefficient is less than or equal to the access risk coefficient threshold, and the third access risk coefficient is less than or equal to the access risk coefficient threshold, and the fourth access risk coefficient is less than or equal to the access risk coefficient threshold, then a normal access risk coefficient is generated according to the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, the fourth access risk coefficient, the first type of weighting coefficient, the second type of weighting coefficient, the third type of weighting coefficient, and the fourth type of weighting coefficient; The normal access risk coefficient is determined as the comprehensive access risk coefficient.

6. The method according to claim 1, characterized in that After processing the user access request according to the access permission instruction, the method further includes: During user access: Obtain user interaction behavior data and interaction timing characteristics; generating interactive behavior features according to the user interactive behavior data; Performing feature analysis on the interaction behavior feature according to the interaction time sequence feature to obtain an interaction behavior abnormality coefficient; If the interaction behavior abnormality coefficient is less than or equal to the first interaction behavior abnormality coefficient threshold, allowing the user to continue accessing; If the interaction behavior abnormality coefficient is greater than the first interaction behavior abnormality coefficient threshold and less than the second interaction behavior abnormality coefficient threshold, the user is allowed to continue accessing and an interaction control change instruction is generated; wherein the interaction control change instruction is used to change the layout of interface elements of the interface accessed by the user; If the interaction behavior abnormality coefficient is greater than the second interaction behavior abnormality coefficient threshold, an access prohibition instruction is generated.

7. A network security protection device, characterized in that: include: An acquisition module, used to acquire any user access request in an access request sequence; A processing module is configured to obtain user agent data, user data, and user behavior verification data based on the user access request; obtain semantic space features and an access request string based on the user agent data; generate a target graph node based on the user data; and obtain a temporal semantic feature based on the access request time sequence and the semantic space features; Obtaining a first access risk coefficient based on the temporal semantic feature; performing context association analysis on the access request character string to obtain a context association feature; Obtaining a timing correlation feature according to the access request timing and the context correlation feature; Obtaining a second access risk coefficient based on the temporal association feature; obtaining a graph node relationship feature based on the target graph node and the preset graph structure; Obtaining a third access risk coefficient based on the graph node relationship characteristics; obtaining a fourth access risk coefficient based on the user data and the user behavior verification data; and obtaining a comprehensive access risk coefficient based on the first access risk coefficient, the second access risk coefficient, the third access risk coefficient, and the fourth access risk coefficient; Generate an access permission instruction or an access blocking instruction according to the comprehensive access risk coefficient and the access risk coefficient threshold; An execution module is used to process the user access request according to the access permission instruction or the access interception instruction, wherein the access permission instruction is used to instruct the user access request to be processed through, and the access interception instruction is used to instruct the user access request to be intercepted.

8. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images